Skip to content
SPECIFICTION
Get listed

Twira Dependency Vulnerabilities

twira.com

From $29.99/mo Free plan WindowsmacOSLinuxAPISelf-hosted
Visit twira.com
Spec score 8.0 #23 of 65 in Software Composition Analysis Software

What it is

Twira Dependency Vulnerabilities scans software lockfiles for known vulnerabilities and filters findings based on whether packages are installed and imported by code. It checks npm, Cargo, PyPI, Go, Maven, RubyGems, Packagist, NuGet, and Swift Package Manager lockfiles against OSV data, which aggregates GHSA, RustSec, PYSEC, the Go vulnerability database, and other feeds. Findings are available as structured JSON or SARIF 2.1.0. After an initial sync, a local vulnerability-data cache with a 24-hour time-to-live supports offline and air-gapped scans. Accepted-risk suppressions persist through lockfile changes, and detections are recorded in an append-only Merkle audit chain. The same binary can run on a laptop, CI runner, or in an air-gapped environment. Twira says indexing runs locally and indexed content is not telemetered; LLM calls use the customer’s chosen provider and key. The free plan does not list SCA. Pro costs $29.99 a month and includes a free 14-day trial. Twira says the scanner covers application dependencies and known vulnerabilities, not novel malware or several other attack types.

Spec sheet

Purpose
Twira Dependency Vulnerabilities is a software composition analysis tool that scans lockfiles against OSV and reports vulnerabilities that pass installed-package and code-import reachability filters.Read 9 Oct 2026 · twira.com
Intended users
Twira describes the product as a tool for developers and their AI agents, including security and compliance workflows.Read 9 Oct 2026 · twira.com
Privacy
Twira says indexing runs locally, indexed content is not telemetered, and LLM calls go through the customer's chosen provider and key.Read 9 Oct 2026 · twira.com
Headquarters
London, United KingdomRead 28 Sep 2026 · twira.com
Company
The maker identifies itself as Twira Ltd, registered in England and Wales, with a registered office in London.Read 9 Oct 2026 · twira.com
Coverage limits
The scanner covers application dependencies and known vulnerabilities; Twira says it does not detect novel malware, typosquatting, dependency confusion, or malicious-maintainer attacks.Read 9 Oct 2026 · twira.com
Integration
An agent can call dependency scanning through the Diagnose MCP tool with the security profile.Read 9 Oct 2026 · twira.com
Not supported
Dart Pub, Hex, Conan, and CocoaPods are not yet supported; the page also excludes SBOM export, licence analysis, runtime monitoring, and container, OS, or firmware scanning.Read 9 Oct 2026 · twira.com
Offline use
The local vulnerability-data cache has a 24-hour TTL and supports offline or air-gapped scans after an initial sync.Read 9 Oct 2026 · twira.com
Output formats
Findings are available as structured JSON by default or SARIF 2.1.0.Read 9 Oct 2026 · twira.com
Run locations
Twira says the same binary can run on a laptop, CI runner, or in an air-gapped environment.Read 9 Oct 2026 · twira.com
Supported ecosystems
It supports lockfiles for npm, Cargo, PyPI, Go, Maven, RubyGems, Packagist, NuGet, and Swift Package Manager.Read 9 Oct 2026 · twira.com
Suppression and audit
Twira says accepted-risk suppressions persist through lockfile changes and each detection is recorded in an append-only Merkle audit chain.Read 9 Oct 2026 · twira.com
Vulnerability data
Twira says its vulnerability data comes from OSV, which aggregates GHSA, RustSec, PYSEC, the Go vulnerability database, and other ecosystem feeds.Read 9 Oct 2026 · twira.com

Plans and prices

Free Free Personal use · Index, Code Search, and Code Read · 26 languages · SCA not listed Read 9 Oct 2026 · twira.com
Pro $29.99 a month Billed in USD; receipt localises to your country. Full toolbelt · SCA with reachability filter · Free 14-day trial · Students with a valid .edu email get Pro free Read 9 Oct 2026 · twira.com

Every Twira Dependency Vulnerabilities plan and price →

Strong points and limits

Strong points

  • Supports nine listed package ecosystems.
  • Provides JSON and SARIF 2.1.0 output.
  • Supports offline scans after an initial data sync.
  • Accepted-risk suppressions persist through lockfile changes.

Limits

  • The free plan does not list SCA.
  • Dart Pub, Hex, Conan, and CocoaPods are unsupported.
  • SBOM export and licence analysis are excluded.
  • It does not detect novel malware or typosquatting.

Who it suits

The tool is aimed at developers and their AI agents, including security and compliance workflows. It suits teams needing dependency checks with reachability filtering or offline scanning.

Verdict

Twira Dependency Vulnerabilities offers lockfile scanning with reachability filtering, local caching, and audit records. The free plan does not list SCA; Pro costs $29.99 a month and includes a 14-day trial.

Where Specifiction places it

Alternatives to Twira Dependency VulnerabilitiesAll alternatives →